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Remarks 

Claims 1-43 were presented for examination and are still pending in this 
application. In an Office Action dated December 10, 2003, claims 1-28 and 30-43 were 
rejected and claim 29 was objected to. Claims 2, 9, 1 1-12, 1 5-19, 23-25, 27, 29-35, and 
41-43 are herein amended solely for the purpose of readability (Le. 9 adding term "and" 
after next to last elements). Claims 44-45 are herein added. Such amended and new 
claims add no new matter and not narrowing amendments for the purposes of 
patentability. Applicants thank Examiner for examination of the claims, for his 
indication that claim 29 contains allowable subject matter, and the subsequent interview 
of March 9, 2004. Applicants now Tequest reconsideration in light of the below remarks 
and allowance of claims 1-45. 

In paragraph 2, Examiner rejected claims 1-5, 8-20, 23-28, 30, 33, 34, and 39-43 
under 35 Q.S.C §102(e) as being anticipated by Gleichauf et aL (U.S. Patent No. 
6,324,656). During the interview, Applicants 9 representative argued that Gleichauf et aL 
fails to disclose, for example, identifying a version and patch level of an operating system 
or service as recited in claim 1 , or sending a third set of packets based on a received 
second set of packets as recited in claim 2. Examiner and Applicants' representative 
reached agreement that the rejection based on Gleichauf et aL should be removed. 
Applicants submit that no new search is necessary since claims have not been 
substantively amended. In addition, independent claims 13, 19, 26, 30, 33, 34, 39, 42, 43, 
related dependent claims, and new independent claims 44-45 contain similar limitations. 
Therefore, Applicant respectfully submits that claims 1-5, 8-20, 23-28, 30, 33, 34, and 
39-45, are in condition fox allowance. 

In paragraph 5, Examiner rejected dependent claims 6 and 22 under 35 U.S.C. 
§l03(a) as being anticipated by Gleichauf et aL in view of Drake (U.S. Patent No. 
6,006,328); in paragraph 6, Examiner rejected claims 7 and 21 under U.S.C §1 03(a) as 
being anticipated by Gleichauf et aL in view of Hombuckle (U.S. Patent No. 5,388,211); 
and in paragraph 7, Examiner rejected claim 37 under U.S.C. §l03(a) as being 
anticipated by Gleichauf et aL in view of Hill et aL (U.S. Patent No. 6 7 088 7 844). Since 
Gleichauf et aL lias been removed, and dependent claims 6 ? 7, 2 1, 22, and 37 stem from 
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^ patentable base claims, Applicant respectfully Submits these claims are also in condition T ?~ - 

for allowance. 

In paragraph 3, Examiner rejected claims 31, 35, 36, and 38 under 35 U.S.C. 
§ 102(e) as being anticipated by Hill et al. Applicants respectfully traverse this rejection. 

Claim 31 is directed to a method of examining a network by, in part, sending 
packets to and receiving packets from a network. Information in the received packets is 
used to identify a trojan application on the network. Advantageously, the network can be 
ggmotelv profiled by characteristics gleaned from infoxmation in response packets. 

Hill et al is directed to a localized security system to detect attack signatures . 
More specifically, security system 20 includes security agents 36 that detect security 
events 50 at associated computer nodes 24, See Abstract; Fig. 1 . Also, attacks are 
mitigated using a list of recommended actions 112 most closely resembling an attack 
signature 94. 

However, Hill et al fails to suggest of disclose the present invention as described 
in claim 3 1 . Whereas claim 31 triages the trojan application with network packets, Hill et 
al is alerted to security events by a locally-based security agent. Thus, these security 
agents must be installed on the network at a server or other host and updated according to 
updates in the network configuration. Moreover, claim 31 uses information in responsive 
data packets, allowing the trojan to be identified by the host's characteristics rather than a 
direct attack signature as in Hill et al Because Hill et ah does not suggest of disclose 
patentable features of claim 31, Applicant submits that the rejection is traversed. Also, 
claims 35, 36, and 38 recite limitations similar to those of claim 31. Therefore, 
i Applicants respectfully submit that claims 31, 35, 36, and 38 are in condition for 

allowance- 
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Conclusion 

In sum, Applicants respectfully submit that 1-45, as presented herein, are 
patentably distinguishable over cited references and other references of record. 
Therefore, Applicants request reconsideration and allowance of these claims. 

In addition, Applicant respectfully invites Examiner to contact Applicants' 
representative at the number provided below if Examiner believes it will help expedite 
furtherance of this application. 

Respectfully submitted, 
John S. Flowers etal. 



Date: March 10, 2Q04_ 



By: 



Dorian Cartwright, Attorney of Record 
Registration No. 53,853 
Fenwick & West LLP 
Silicon Valley Center 
801 California Street 
Mountain View, CA 94041 
Phone: (650)335-7247 
Fax: (650) 938^5200 
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